How to Audit a Sterile Fill-Finish CDMO in 2026

Why Sterile Fill-Finish CDMO Audits Carry Greater Weight in 2026

The 2023 revision of the European Medicines Agency’s Good Manufacturing Practice Annex 1 introduced mandatory Contamination Control Strategy documentation, raising the formal compliance threshold for aseptic processing sites across the sector. At the same time, sterile injectable supply chain disruptions have intensified regulatory and commercial scrutiny of CDMO network depth and manufacturing continuity planning.

For pharmaceutical and biotech quality leaders overseeing sterile injectable CDMO technology transfer and commercial manufacturing partnerships, a poorly structured audit creates material gaps. Those gaps do not simply reside within internal quality logs. They surface during inspections by the European Medicines Agency or the United States Food and Drug Administration, and in the most serious cases, during supply events that affect patients directly.

This guide provides a structured framework for quality leaders and clinical supply teams conducting on-site or remote evaluations of sterile fill-finish CDMOs.

Before You Begin: Pre-Audit Documentation

A productive audit begins well before you arrive at the facility. Request the following documentation in advance. Reviewing this package allows on-site time to be directed at genuine risk areas rather than background orientation.

• Current Good Manufacturing Practice certification documents and a full list of issuing health authorities
• The most recent regulatory inspection outcomes and any resulting Corrective Action and Preventive Action documentation
• A summary or index of the site’s Contamination Control Strategy
• The current Site Master File or equivalent facility overview document
• Technology transfer case studies or capability statements relevant to your target dosage form
• Aseptic Process Simulation reports from the most recent manufacturing campaign

The quality management system forms the foundation of every other area you will evaluate. A system aligned with the International Council for Harmonisation Q10 guideline on Pharmaceutical Quality System should be demonstrably operational, not merely documented.

• Does the site apply a risk-based approach to quality decisions consistent with ICH Q9 on Quality Risk Management?
• How are deviations classified, investigated and closed? What does the current open deviation backlog indicate about resolution efficiency?
• Is the Corrective Action and Preventive Action process substantively linked to root cause analysis, or is it procedurally compliant but practically superficial?
• How does the quality management system interface with customer escalation rights and notification obligations?
• What is the site’s completion rate and average cycle time for Annual Product Quality Reviews?

The Contamination Control Strategy is now one of the most consequential documents a sterile fill-finish site must maintain. Mandated under the revised EMA Annex 1 (2023), a robust strategy must be holistic, risk-based and subject to formal periodic review. It must address all contamination vectors as an interconnected system, not a collection of standalone procedures.

• Is the Contamination Control Strategy a living document, reviewed at defined intervals and following relevant events such as deviations or environmental excursions?
• Does it address personnel, equipment, utilities, materials, process and environment as interconnected risk factors rather than isolated categories?
• How is Restricted Access Barrier System (RABS) or isolator technology validated and re-qualified at defined intervals?
• What is the scope and frequency of the environmental monitoring programme, and how are adverse trends investigated and escalated?
• How are Aseptic Process Simulations designed, conducted and reviewed? What thresholds trigger a formal process review?

The physical infrastructure of a sterile fill-finish site underpins every product manufactured within it. Qualification status must be current, documented and traceable across all critical systems.

• Are all critical utilities — Water for Injection, Pure Steam and Compressed Gases — formally qualified and subject to continuous monitoring?
• What is the current qualification status of filling lines, lyophilisers and visual inspection systems?
• How does the site manage equipment maintenance intervals in relation to campaign planning and batch scheduling?
• Are cleaning validation records available and current for all shared product-contact equipment?
• Which container closure formats are currently validated — vials, prefilled syringes and ampoules — and how are format changes managed through formal change control?

Technology transfer is the formalised process through which manufacturing knowledge is relocated from a development or originator environment to the CDMO’s facility. It is one of the highest-risk phases in any sterile injectable CDMO partnership and warrants specific, targeted audit focus.

• Does the CDMO maintain a defined technology transfer protocol template, and how are knowledge gaps identified and managed throughout the process?
• What documented experience does the site hold in receiving transfers for your specific dosage form: liquid vials, lyophilised vials, prefilled syringes or ampoules?
• How does the site approach process characterisation and validation planning at receiving scale?
• What are the documented timelines from signed agreement to first Good Manufacturing Practice batch for transfers in your dosage form category?
• How are comparability studies and analytical method transfers managed, and who holds responsibility for release testing at each stage?

Data integrity failures remain among the most frequently cited grounds for regulatory enforcement actions against pharmaceutical manufacturers worldwide. For sterile fill-finish operations, where batch record accuracy and environmental monitoring data directly affect patient safety, this area requires rigorous and structured evaluation.

• Does the site operate a formal data governance framework aligned with ALCOA+ principles: Attributable, Legible, Contemporaneous, Original, Accurate, Complete, Consistent, Enduring and Available?
• How are electronic records backed up, and what audit trail review processes are in operation?
• Are documented controls in place to prevent backdating or unauthorised alteration of manufacturing records or environmental monitoring data?
• How does the site manage hybrid systems that combine paper records and electronic data capture?
• Have any data integrity observations been raised during regulatory inspections at this site within the past five years?

A CDMO’s in-house analytical resource directly affects batch release timelines, stability data package completeness and regulatory submission readiness. Understanding the breadth of on-site capability reduces dependency on third-party contract laboratories and the associated method transfer risks.

• Which release testing methods are performed in-house, and which are outsourced to external contract laboratories?
• Does the site perform sterility testing, endotoxin detection, bioburden assessment, container closure integrity testing and appearance inspection internally?
• What stability chamber capacity is available and under which International Council for Harmonisation climatic zone conditions?
• Does the site have documented experience managing stability data packages for Chemistry, Manufacturing and Controls documentation submitted to the EMA and FDA?
• How are out-of-specification results managed, and what is the documented investigation and resolution process?

Sterile injectable supply chain disruptions represent an operational risk that has grown considerably in profile. Raw material shortages, primary packaging allocation constraints and Active Pharmaceutical Ingredient supply events have each affected sterile injectable programmes across the sector. A CDMO’s supply chain strategy should be explicit, documented and auditable.

• What is the site’s supplier qualification process for critical raw materials and primary packaging components?
• Does the site maintain approved secondary suppliers for critical excipients and primary packaging materials?
• How does the CDMO manage capacity allocation across its customer base during supply-constrained periods?
• What minimum lead times apply to primary packaging materials relevant to your target dosage form?
• How are supply chain disruptions communicated to customers, and what contractual timelines govern notification obligations?

A CDMO’s regulatory standing is a matter of public and contractual record. It must be reviewed carefully and systematically before entering a commercial manufacturing partnership.

• Which health authorities hold current Good Manufacturing Practice certification for this site, and when were those certifications most recently issued or renewed?
• Are any warning letters, import alerts or equivalent enforcement actions currently in force against this site?
• What was the classification and corrective action outcome of the most recent regulatory inspection?
• Does the site hold certifications relevant to your target markets — such as FDA approval for United States market access, EMA certification for European Union access or Pharmaceuticals and Medical Devices Agency certification for the Japanese market?
• How does the CDMO support customers in responding to regulatory authority questions about site-specific manufacturing and analytical data?

The technical competence and continuity of the people operating the facility carry as much weight as the equipment and procedures they use. Organisational instability in key roles presents a risk that documentation alone cannot mitigate.

• What is the site’s attrition rate for Qualified Persons, aseptic operators and quality management personnel over the past two years?
• How are aseptic operators trained and re-qualified, and what is the qualification validity period?
• Is gowning qualification performed at defined intervals and documented at individual operator level?
• Does the site operate a structured knowledge management process that protects institutional expertise through personnel transitions?
• Who serves as the dedicated programme contact for your account, and what escalation pathway exists to technical and quality leadership?

After the Audit: Structured Evaluation and Next Steps

Once the audit is complete, assess findings against a risk-tiered framework:

• Critical observations: Findings that represent an immediate patient safety risk or an unresolvable regulatory barrier to supply.
• Major observations: Findings that require documented corrective action before a supply commitment can be made.
• Minor observations: Findings manageable through ongoing supplier quality agreements and scheduled monitoring.

Your completed audit report forms part of the supplier qualification documentation retained on file for regulatory inspection purposes. If you are progressing a sterile injectable CDMO technology transfer and commercial manufacturing agreement, audit findings will directly inform the Technical Quality Agreement scope, change control provisions and the ongoing CDMO oversight programme.

Adragos Pharma Sterile Cluster: Capabilities at a Glance

For organisations evaluating a commercial technology transfer to a European CDMO, or seeking integrated Phase I to commercial contract manufacturing services, the following table summarises the sterile manufacturing capabilities across the Adragos Pharma network.